银狐木马 CTF 主要知识点（精简版）

/* MD / 富文本中的 .toc（含博客园搬家等嵌套结构）；.toc-box 在侧栏，不受影响 */
#content_views .toc,
/* 编辑器常在目录前后插入空 p（:empty 仍占 20px），一并去掉避免顶空隙 */
#content_views.markdown_views > p:empty:has(+ .toc),
#content_views.markdown_views > .toc + p:empty,
/* 富文本旧版目录标记 */
#content_views.htmledit_views #main-toc,
#content_views.htmledit_views #hr-toc,
#content_views.htmledit_views p[id*=\”-toc\”] {
display: none !important;
}
/* 目录去掉后，紧跟的首个标题不再多出一块上边距 */
#content_views.markdown_views > .toc + h1,
#content_views.markdown_views > .toc + h2,
#content_views.markdown_views > .toc + h3,
#content_views.markdown_views > .toc + h4,
#content_views.markdown_views > .toc + p:empty + h1,
#content_views.markdown_views > .toc + p:empty + h2,
#content_views.markdown_views > .toc + p:empty + h3,
#content_views.markdown_views > .toc + p:empty + h4 {
margin-top: 0 !important;
}

1. 总体定位

摘要：本文梳理银狐木马 CTF 的核心考点，围绕「钓鱼投递 → 白加黑/非 PE 载荷 → 内存加载 → 持久化 → C2 通信 → 对抗清理」的完整攻击链展开，覆盖逆向分析（反沙箱门控、加密解密、白加黑、非 PE 载荷、动态解析 API）、流量分析（C2 信道、心跳特征、简单编码、隐蔽通信识别）、隐写与取证（载荷藏匿位置、"增肥"战术）、应急响应与日志分析（傀儡计划任务、隐藏持久化、Rootkit/BYOVD、无文件驻留、处置判据）以及通用判断原则，帮助读者快速建立解题思路与清理完整性判断标准。

银狐 CTF 考查的不是单一静态样本，而是一条完整攻击链：
钓鱼投递 → 白加黑/非 PE 载荷 → 内存加载 → 持久化 → C2 通信 → 对抗清理

核心特征：

• 免杀迭代快
• 多层反分析
• 白加黑
• 无文件/非 PE 载荷
• 冗余持久化
• Rootkit/BYOVD 对抗

高频题型：逆向分析、流量分析、隐写取证、应急响应与日志分析。

下面用一张流程图概括银狐木马的完整攻击链：

#mermaid-svg-HcVXHQLlSjELkVc7{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-HcVXHQLlSjELkVc7 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-HcVXHQLlSjELkVc7 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-HcVXHQLlSjELkVc7 .error-icon{fill:#552222;}#mermaid-svg-HcVXHQLlSjELkVc7 .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-HcVXHQLlSjELkVc7 .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-HcVXHQLlSjELkVc7 .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-HcVXHQLlSjELkVc7 .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-HcVXHQLlSjELkVc7 .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-HcVXHQLlSjELkVc7 .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-HcVXHQLlSjELkVc7 .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-HcVXHQLlSjELkVc7 .marker{fill:#333333;stroke:#333333;}#mermaid-svg-HcVXHQLlSjELkVc7 .marker.cross{stroke:#333333;}#mermaid-svg-HcVXHQLlSjELkVc7 svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-HcVXHQLlSjELkVc7 p{margin:0;}#mermaid-svg-HcVXHQLlSjELkVc7 .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-HcVXHQLlSjELkVc7 .cluster-label text{fill:#333;}#mermaid-svg-HcVXHQLlSjELkVc7 .cluster-label span{color:#333;}#mermaid-svg-HcVXHQLlSjELkVc7 .cluster-label span p{background-color:transparent;}#mermaid-svg-HcVXHQLlSjELkVc7 .label text,#mermaid-svg-HcVXHQLlSjELkVc7 span{fill:#333;color:#333;}#mermaid-svg-HcVXHQLlSjELkVc7 .node rect,#mermaid-svg-HcVXHQLlSjELkVc7 .node circle,#mermaid-svg-HcVXHQLlSjELkVc7 .node ellipse,#mermaid-svg-HcVXHQLlSjELkVc7 .node polygon,#mermaid-svg-HcVXHQLlSjELkVc7 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-HcVXHQLlSjELkVc7 .rough-node .label text,#mermaid-svg-HcVXHQLlSjELkVc7 .node .label text,#mermaid-svg-HcVXHQLlSjELkVc7 .image-shape .label,#mermaid-svg-HcVXHQLlSjELkVc7 .icon-shape .label{text-anchor:middle;}#mermaid-svg-HcVXHQLlSjELkVc7 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-HcVXHQLlSjELkVc7 .rough-node .label,#mermaid-svg-HcVXHQLlSjELkVc7 .node .label,#mermaid-svg-HcVXHQLlSjELkVc7 .image-shape .label,#mermaid-svg-HcVXHQLlSjELkVc7 .icon-shape .label{text-align:center;}#mermaid-svg-HcVXHQLlSjELkVc7 .node.clickable{cursor:pointer;}#mermaid-svg-HcVXHQLlSjELkVc7 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-HcVXHQLlSjELkVc7 .arrowheadPath{fill:#333333;}#mermaid-svg-HcVXHQLlSjELkVc7 .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-HcVXHQLlSjELkVc7 .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-HcVXHQLlSjELkVc7 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-HcVXHQLlSjELkVc7 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-HcVXHQLlSjELkVc7 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-HcVXHQLlSjELkVc7 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-HcVXHQLlSjELkVc7 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-HcVXHQLlSjELkVc7 .cluster text{fill:#333;}#mermaid-svg-HcVXHQLlSjELkVc7 .cluster span{color:#333;}#mermaid-svg-HcVXHQLlSjELkVc7 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-HcVXHQLlSjELkVc7 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-HcVXHQLlSjELkVc7 rect.text{fill:none;stroke-width:0;}#mermaid-svg-HcVXHQLlSjELkVc7 .icon-shape,#mermaid-svg-HcVXHQLlSjELkVc7 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-HcVXHQLlSjELkVc7 .icon-shape p,#mermaid-svg-HcVXHQLlSjELkVc7 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-HcVXHQLlSjELkVc7 .icon-shape .label rect,#mermaid-svg-HcVXHQLlSjELkVc7 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-HcVXHQLlSjELkVc7 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-HcVXHQLlSjELkVc7 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-HcVXHQLlSjELkVc7 :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

钓鱼投递

白加黑/非 PE 载荷

内存加载

持久化

C2 通信

对抗清理

2. 逆向分析

2.1 反沙箱门控

常见手段：CPUID、RDTSC、GPU-FPS、安全软件探测。

考点：定位门控的汇合点并 patch。

2.2 加密解密

常见算法：XOR 0x36、RC4 变体、AES-ECB、ChaCha20 + LZNT1、GPU shader。

考点：识别 Shellcode 特征字节和动态函数指针调用。

2.3 白加黑

合法签名程序被 PATCH（如 3 字节 jmp），入口不在导入/导出表。

思路：先定位「白」文件中的异常跳转。

2.4 非 PE 载荷

.oi/.vc/.ti/.er 等自定义文件由白文件读取解密执行，磁盘无恶意 PE。

2.5 动态解析 API

静态看到的 API 可能是假的，需动态调试确认。

逆向分析的整体思路可归纳为：

#mermaid-svg-wz7WAT2Ew68M7CxU{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-wz7WAT2Ew68M7CxU .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-wz7WAT2Ew68M7CxU .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-wz7WAT2Ew68M7CxU .error-icon{fill:#552222;}#mermaid-svg-wz7WAT2Ew68M7CxU .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-wz7WAT2Ew68M7CxU .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-wz7WAT2Ew68M7CxU .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-wz7WAT2Ew68M7CxU .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-wz7WAT2Ew68M7CxU .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-wz7WAT2Ew68M7CxU .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-wz7WAT2Ew68M7CxU .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-wz7WAT2Ew68M7CxU .marker{fill:#333333;stroke:#333333;}#mermaid-svg-wz7WAT2Ew68M7CxU .marker.cross{stroke:#333333;}#mermaid-svg-wz7WAT2Ew68M7CxU svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-wz7WAT2Ew68M7CxU p{margin:0;}#mermaid-svg-wz7WAT2Ew68M7CxU .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-wz7WAT2Ew68M7CxU .cluster-label text{fill:#333;}#mermaid-svg-wz7WAT2Ew68M7CxU .cluster-label span{color:#333;}#mermaid-svg-wz7WAT2Ew68M7CxU .cluster-label span p{background-color:transparent;}#mermaid-svg-wz7WAT2Ew68M7CxU .label text,#mermaid-svg-wz7WAT2Ew68M7CxU span{fill:#333;color:#333;}#mermaid-svg-wz7WAT2Ew68M7CxU .node rect,#mermaid-svg-wz7WAT2Ew68M7CxU .node circle,#mermaid-svg-wz7WAT2Ew68M7CxU .node ellipse,#mermaid-svg-wz7WAT2Ew68M7CxU .node polygon,#mermaid-svg-wz7WAT2Ew68M7CxU .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-wz7WAT2Ew68M7CxU .rough-node .label text,#mermaid-svg-wz7WAT2Ew68M7CxU .node .label text,#mermaid-svg-wz7WAT2Ew68M7CxU .image-shape .label,#mermaid-svg-wz7WAT2Ew68M7CxU .icon-shape .label{text-anchor:middle;}#mermaid-svg-wz7WAT2Ew68M7CxU .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-wz7WAT2Ew68M7CxU .rough-node .label,#mermaid-svg-wz7WAT2Ew68M7CxU .node .label,#mermaid-svg-wz7WAT2Ew68M7CxU .image-shape .label,#mermaid-svg-wz7WAT2Ew68M7CxU .icon-shape .label{text-align:center;}#mermaid-svg-wz7WAT2Ew68M7CxU .node.clickable{cursor:pointer;}#mermaid-svg-wz7WAT2Ew68M7CxU .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-wz7WAT2Ew68M7CxU .arrowheadPath{fill:#333333;}#mermaid-svg-wz7WAT2Ew68M7CxU .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-wz7WAT2Ew68M7CxU .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-wz7WAT2Ew68M7CxU .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-wz7WAT2Ew68M7CxU .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-wz7WAT2Ew68M7CxU .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-wz7WAT2Ew68M7CxU .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-wz7WAT2Ew68M7CxU .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-wz7WAT2Ew68M7CxU .cluster text{fill:#333;}#mermaid-svg-wz7WAT2Ew68M7CxU .cluster span{color:#333;}#mermaid-svg-wz7WAT2Ew68M7CxU div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-wz7WAT2Ew68M7CxU .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-wz7WAT2Ew68M7CxU rect.text{fill:none;stroke-width:0;}#mermaid-svg-wz7WAT2Ew68M7CxU .icon-shape,#mermaid-svg-wz7WAT2Ew68M7CxU .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-wz7WAT2Ew68M7CxU .icon-shape p,#mermaid-svg-wz7WAT2Ew68M7CxU .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-wz7WAT2Ew68M7CxU .icon-shape .label rect,#mermaid-svg-wz7WAT2Ew68M7CxU .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-wz7WAT2Ew68M7CxU .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-wz7WAT2Ew68M7CxU .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-wz7WAT2Ew68M7CxU :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

是

否

是

否

拿到样本

是否为白加黑

定位白文件异常跳转

直接分析载荷

提取非 PE 载荷并解密

是否存在反沙箱门控

定位汇合点并 patch

动态调试确认 API

还原 Shellcode 与执行流

3. 流量分析

3.1 C2 信道

常见信道：DoH、WebSocket、QUIC、HTTP/2 gRPC。

重点关注：TLS 证书/SNI、JA3/JA4 指纹、通信时序周期性、目的地址信誉。

3.2 心跳特征

30–90 秒低体积 HTTPS POST beacon，区别于突发大体积载荷下载。

3.3 简单编码

如 (byte^0xfc+0x31)&0xff、单字节 XOR。

建议先尝试简单变换，不要直接假设为强加密。

3.4 隐蔽通信识别

• DoH 内层域名异常
• 请求频率/时序不匹配
• 云存储下载路径随机性

流量分析可按以下顺序排查：

#mermaid-svg-pUgibZVkmDjbEiEj{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-pUgibZVkmDjbEiEj .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-pUgibZVkmDjbEiEj .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-pUgibZVkmDjbEiEj .error-icon{fill:#552222;}#mermaid-svg-pUgibZVkmDjbEiEj .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-pUgibZVkmDjbEiEj .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-pUgibZVkmDjbEiEj .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-pUgibZVkmDjbEiEj .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-pUgibZVkmDjbEiEj .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-pUgibZVkmDjbEiEj .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-pUgibZVkmDjbEiEj .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-pUgibZVkmDjbEiEj .marker{fill:#333333;stroke:#333333;}#mermaid-svg-pUgibZVkmDjbEiEj .marker.cross{stroke:#333333;}#mermaid-svg-pUgibZVkmDjbEiEj svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-pUgibZVkmDjbEiEj p{margin:0;}#mermaid-svg-pUgibZVkmDjbEiEj .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-pUgibZVkmDjbEiEj .cluster-label text{fill:#333;}#mermaid-svg-pUgibZVkmDjbEiEj .cluster-label span{color:#333;}#mermaid-svg-pUgibZVkmDjbEiEj .cluster-label span p{background-color:transparent;}#mermaid-svg-pUgibZVkmDjbEiEj .label text,#mermaid-svg-pUgibZVkmDjbEiEj span{fill:#333;color:#333;}#mermaid-svg-pUgibZVkmDjbEiEj .node rect,#mermaid-svg-pUgibZVkmDjbEiEj .node circle,#mermaid-svg-pUgibZVkmDjbEiEj .node ellipse,#mermaid-svg-pUgibZVkmDjbEiEj .node polygon,#mermaid-svg-pUgibZVkmDjbEiEj .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-pUgibZVkmDjbEiEj .rough-node .label text,#mermaid-svg-pUgibZVkmDjbEiEj .node .label text,#mermaid-svg-pUgibZVkmDjbEiEj .image-shape .label,#mermaid-svg-pUgibZVkmDjbEiEj .icon-shape .label{text-anchor:middle;}#mermaid-svg-pUgibZVkmDjbEiEj .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-pUgibZVkmDjbEiEj .rough-node .label,#mermaid-svg-pUgibZVkmDjbEiEj .node .label,#mermaid-svg-pUgibZVkmDjbEiEj .image-shape .label,#mermaid-svg-pUgibZVkmDjbEiEj .icon-shape .label{text-align:center;}#mermaid-svg-pUgibZVkmDjbEiEj .node.clickable{cursor:pointer;}#mermaid-svg-pUgibZVkmDjbEiEj .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-pUgibZVkmDjbEiEj .arrowheadPath{fill:#333333;}#mermaid-svg-pUgibZVkmDjbEiEj .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-pUgibZVkmDjbEiEj .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-pUgibZVkmDjbEiEj .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-pUgibZVkmDjbEiEj .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-pUgibZVkmDjbEiEj .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-pUgibZVkmDjbEiEj .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-pUgibZVkmDjbEiEj .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-pUgibZVkmDjbEiEj .cluster text{fill:#333;}#mermaid-svg-pUgibZVkmDjbEiEj .cluster span{color:#333;}#mermaid-svg-pUgibZVkmDjbEiEj div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-pUgibZVkmDjbEiEj .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-pUgibZVkmDjbEiEj rect.text{fill:none;stroke-width:0;}#mermaid-svg-pUgibZVkmDjbEiEj .icon-shape,#mermaid-svg-pUgibZVkmDjbEiEj .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-pUgibZVkmDjbEiEj .icon-shape p,#mermaid-svg-pUgibZVkmDjbEiEj .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-pUgibZVkmDjbEiEj .icon-shape .label rect,#mermaid-svg-pUgibZVkmDjbEiEj .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-pUgibZVkmDjbEiEj .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-pUgibZVkmDjbEiEj .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-pUgibZVkmDjbEiEj :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

是

否

抓包/流量日志

筛选 TLS 证书与 SNI

计算 JA3/JA4 指纹

是否存在周期性小体积 POST

判定为心跳 beacon

排查 DoH/WebSocket/QUIC 信道

尝试简单编码还原

定位 C2 与载荷下载地址

4. 隐写与取证

4.1 载荷藏匿位置

PNG 像素数据、.pyc 异常字节码、HFEX 容器、大 PE 尾部 overlay/高熵区域。

4.2 "增肥"战术

在大文件中混入小载荷，以稀释 YARA 特征、干扰 strings 提取、绕过沙箱的文件大小限制。

4.3 考点

磁盘无恶意 PE 时，从内存转储、图像熵异常、非标准文件结构中提取 Stage-2。

隐写与取证的提取路径如下：

#mermaid-svg-vCrxiAKGZEgn8ZCc{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-vCrxiAKGZEgn8ZCc .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-vCrxiAKGZEgn8ZCc .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-vCrxiAKGZEgn8ZCc .error-icon{fill:#552222;}#mermaid-svg-vCrxiAKGZEgn8ZCc .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-vCrxiAKGZEgn8ZCc .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-vCrxiAKGZEgn8ZCc .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-vCrxiAKGZEgn8ZCc .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-vCrxiAKGZEgn8ZCc .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-vCrxiAKGZEgn8ZCc .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-vCrxiAKGZEgn8ZCc .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-vCrxiAKGZEgn8ZCc .marker{fill:#333333;stroke:#333333;}#mermaid-svg-vCrxiAKGZEgn8ZCc .marker.cross{stroke:#333333;}#mermaid-svg-vCrxiAKGZEgn8ZCc svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-vCrxiAKGZEgn8ZCc p{margin:0;}#mermaid-svg-vCrxiAKGZEgn8ZCc .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-vCrxiAKGZEgn8ZCc .cluster-label text{fill:#333;}#mermaid-svg-vCrxiAKGZEgn8ZCc .cluster-label span{color:#333;}#mermaid-svg-vCrxiAKGZEgn8ZCc .cluster-label span p{background-color:transparent;}#mermaid-svg-vCrxiAKGZEgn8ZCc .label text,#mermaid-svg-vCrxiAKGZEgn8ZCc span{fill:#333;color:#333;}#mermaid-svg-vCrxiAKGZEgn8ZCc .node rect,#mermaid-svg-vCrxiAKGZEgn8ZCc .node circle,#mermaid-svg-vCrxiAKGZEgn8ZCc .node ellipse,#mermaid-svg-vCrxiAKGZEgn8ZCc .node polygon,#mermaid-svg-vCrxiAKGZEgn8ZCc .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-vCrxiAKGZEgn8ZCc .rough-node .label text,#mermaid-svg-vCrxiAKGZEgn8ZCc .node .label text,#mermaid-svg-vCrxiAKGZEgn8ZCc .image-shape .label,#mermaid-svg-vCrxiAKGZEgn8ZCc .icon-shape .label{text-anchor:middle;}#mermaid-svg-vCrxiAKGZEgn8ZCc .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-vCrxiAKGZEgn8ZCc .rough-node .label,#mermaid-svg-vCrxiAKGZEgn8ZCc .node .label,#mermaid-svg-vCrxiAKGZEgn8ZCc .image-shape .label,#mermaid-svg-vCrxiAKGZEgn8ZCc .icon-shape .label{text-align:center;}#mermaid-svg-vCrxiAKGZEgn8ZCc .node.clickable{cursor:pointer;}#mermaid-svg-vCrxiAKGZEgn8ZCc .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-vCrxiAKGZEgn8ZCc .arrowheadPath{fill:#333333;}#mermaid-svg-vCrxiAKGZEgn8ZCc .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-vCrxiAKGZEgn8ZCc .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-vCrxiAKGZEgn8ZCc .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-vCrxiAKGZEgn8ZCc .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-vCrxiAKGZEgn8ZCc .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-vCrxiAKGZEgn8ZCc .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-vCrxiAKGZEgn8ZCc .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-vCrxiAKGZEgn8ZCc .cluster text{fill:#333;}#mermaid-svg-vCrxiAKGZEgn8ZCc .cluster span{color:#333;}#mermaid-svg-vCrxiAKGZEgn8ZCc div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-vCrxiAKGZEgn8ZCc .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-vCrxiAKGZEgn8ZCc rect.text{fill:none;stroke-width:0;}#mermaid-svg-vCrxiAKGZEgn8ZCc .icon-shape,#mermaid-svg-vCrxiAKGZEgn8ZCc .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-vCrxiAKGZEgn8ZCc .icon-shape p,#mermaid-svg-vCrxiAKGZEgn8ZCc .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-vCrxiAKGZEgn8ZCc .icon-shape .label rect,#mermaid-svg-vCrxiAKGZEgn8ZCc .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-vCrxiAKGZEgn8ZCc .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-vCrxiAKGZEgn8ZCc .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-vCrxiAKGZEgn8ZCc :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

磁盘无恶意 PE

内存转储

图像熵异常检测

非标准文件结构解析

提取 Stage-2

验证载荷可执行性

5. 应急响应与日志分析

5.1 傀儡计划任务

临时任务执行后自删，母体/看门狗会重新拉起进程。

处置顺序：先切断母体，再清持久化。

5.2 隐藏持久化

注册表键值修改使常规 API 无法枚举删除，需完整定位所有载体。

5.3 Rootkit/BYOVD

Nidhogg 等 Rootkit 拦截进程关闭；BYOVD 提权关杀软；内核命名管道通信。

5.4 无文件驻留

MSI CustomAction 嵌入 DLL、反射式加载、临时服务自毁；磁盘无 PE，但仍有外连。

5.5 处置判据

不是“删了某个文件/断了当前连接”，而是所有加载阶段、持久化载体、C2 通道和 fallback 均被切断。

应急响应的处置流程建议如下：

#mermaid-svg-zN7McS5aVFXowxKY{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-zN7McS5aVFXowxKY .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-zN7McS5aVFXowxKY .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-zN7McS5aVFXowxKY .error-icon{fill:#552222;}#mermaid-svg-zN7McS5aVFXowxKY .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-zN7McS5aVFXowxKY .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-zN7McS5aVFXowxKY .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-zN7McS5aVFXowxKY .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-zN7McS5aVFXowxKY .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-zN7McS5aVFXowxKY .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-zN7McS5aVFXowxKY .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-zN7McS5aVFXowxKY .marker{fill:#333333;stroke:#333333;}#mermaid-svg-zN7McS5aVFXowxKY .marker.cross{stroke:#333333;}#mermaid-svg-zN7McS5aVFXowxKY svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-zN7McS5aVFXowxKY p{margin:0;}#mermaid-svg-zN7McS5aVFXowxKY .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-zN7McS5aVFXowxKY .cluster-label text{fill:#333;}#mermaid-svg-zN7McS5aVFXowxKY .cluster-label span{color:#333;}#mermaid-svg-zN7McS5aVFXowxKY .cluster-label span p{background-color:transparent;}#mermaid-svg-zN7McS5aVFXowxKY .label text,#mermaid-svg-zN7McS5aVFXowxKY span{fill:#333;color:#333;}#mermaid-svg-zN7McS5aVFXowxKY .node rect,#mermaid-svg-zN7McS5aVFXowxKY .node circle,#mermaid-svg-zN7McS5aVFXowxKY .node ellipse,#mermaid-svg-zN7McS5aVFXowxKY .node polygon,#mermaid-svg-zN7McS5aVFXowxKY .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-zN7McS5aVFXowxKY .rough-node .label text,#mermaid-svg-zN7McS5aVFXowxKY .node .label text,#mermaid-svg-zN7McS5aVFXowxKY .image-shape .label,#mermaid-svg-zN7McS5aVFXowxKY .icon-shape .label{text-anchor:middle;}#mermaid-svg-zN7McS5aVFXowxKY .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-zN7McS5aVFXowxKY .rough-node .label,#mermaid-svg-zN7McS5aVFXowxKY .node .label,#mermaid-svg-zN7McS5aVFXowxKY .image-shape .label,#mermaid-svg-zN7McS5aVFXowxKY .icon-shape .label{text-align:center;}#mermaid-svg-zN7McS5aVFXowxKY .node.clickable{cursor:pointer;}#mermaid-svg-zN7McS5aVFXowxKY .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-zN7McS5aVFXowxKY .arrowheadPath{fill:#333333;}#mermaid-svg-zN7McS5aVFXowxKY .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-zN7McS5aVFXowxKY .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-zN7McS5aVFXowxKY .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-zN7McS5aVFXowxKY .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-zN7McS5aVFXowxKY .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-zN7McS5aVFXowxKY .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-zN7McS5aVFXowxKY .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-zN7McS5aVFXowxKY .cluster text{fill:#333;}#mermaid-svg-zN7McS5aVFXowxKY .cluster span{color:#333;}#mermaid-svg-zN7McS5aVFXowxKY div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-zN7McS5aVFXowxKY .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-zN7McS5aVFXowxKY rect.text{fill:none;stroke-width:0;}#mermaid-svg-zN7McS5aVFXowxKY .icon-shape,#mermaid-svg-zN7McS5aVFXowxKY .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-zN7McS5aVFXowxKY .icon-shape p,#mermaid-svg-zN7McS5aVFXowxKY .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-zN7McS5aVFXowxKY .icon-shape .label rect,#mermaid-svg-zN7McS5aVFXowxKY .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-zN7McS5aVFXowxKY .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-zN7McS5aVFXowxKY .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-zN7McS5aVFXowxKY :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

否

是

发现异常外连

定位母体与看门狗进程

切断母体，阻止重新拉起

清理计划任务与注册表持久化

卸载 Rootkit/BYOVD 驱动

阻断 C2 通道与 fallback

所有加载阶段与载体是否清除

处置完成

6. 通用判断原则

银狐把真实意图藏在“正常”之下：正常签名、正常安装、正常 DNS、正常计划任务。

CTF 解题关键是找结构不一致：

• 白文件多出的跳转
• 异常计划任务
• DoH 中不应出现的域名
• 大 PE 尾部加密块

高频记忆：

门控找汇合点，加密找特征字节，C2 看元数据，取证找熵异常，应急先断母体再清载体。

一句话总结：银狐 CTF 的核心不是“识别样本”，而是从白加黑入口、内存加载、隐蔽 C2、冗余持久化、内核对抗五个层面还原攻击链，并判断清理是否完整。